claudekit-cli 3.37.0-dev.1 → 3.37.0-dev.3

package/README.md

@@ -91,6 +91,9 @@ ck --help
 # Open config dashboard immediately
 ck config
 
+# Expose the dashboard intentionally to your LAN/Tailscale
+ck config --host 0.0.0.0 --no-open
+
 # Command-level help (recommended)
 ck config --help
 ck skills --help
@@ -99,6 +102,23 @@ ck commands --help
 ck migrate --help
 ```
 
+### Config Dashboard Access
+
+By default, `ck config` binds the dashboard to `127.0.0.1` for local-only access.
+
+Use `--host` when you intentionally want remote access from another device on the same trusted network:
+
+```bash
+# Bind to all interfaces
+ck config --host 0.0.0.0 --no-open
+
+# Bind to a specific interface or hostname
+ck config --host 100.88.12.4 --no-open
+ck config --host dashboard.local --no-open
+```
+
+The dashboard still enforces same-origin browser access. Remote access works when you open the UI from the same host/origin that reaches the server, instead of relying on a hardcoded IP allowlist.
+
 ### Create New Project
 
 ```bash

package/dist/index.js

@@ -42221,6 +42221,68 @@ var init_claudekit_data = __esm(() => {
 });
 
 // src/types/ck-config.ts
+function normalizeMigrateProviderToken(token) {
+  const trimmed = token.trim();
+  const unwrapped = trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'") ? trimmed.slice(1, -1) : trimmed;
+  return unwrapped.trim().toLowerCase();
+}
+function parseMigrateProvidersString(value) {
+  const trimmed = value.trim();
+  if (!trimmed)
+    return [];
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed === "string" || Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {}
+  if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+    return trimmed.slice(1, -1).split(",").map((part) => part.trim()).filter(Boolean);
+  }
+  return trimmed;
+}
+function normalizeMigrateProviderList(value) {
+  const parts = value.map(normalizeMigrateProviderToken).filter(Boolean).filter((part, index, list) => list.indexOf(part) === index);
+  if (parts.length === 0 || parts.length === 1 && parts[0] === "auto") {
+    return "auto";
+  }
+  return parts.filter((part) => part !== "auto");
+}
+function normalizeMigrateProvidersValue(value) {
+  if (typeof value === "string") {
+    const parsed = parseMigrateProvidersString(value);
+    const parts = Array.isArray(parsed) ? parsed : String(parsed).split(",");
+    return normalizeMigrateProviderList(parts);
+  }
+  if (Array.isArray(value)) {
+    return normalizeMigrateProviderList(value.filter((item) => typeof item === "string"));
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return normalizeMigrateProvidersValue(String(value));
+  }
+  return value;
+}
+function normalizeMigrateProvidersInput(value) {
+  const normalized = normalizeMigrateProvidersValue(value);
+  if (normalized === "auto" || Array.isArray(normalized)) {
+    return normalized;
+  }
+  return normalizeMigrateProviderList(String(normalized).split(","));
+}
+function normalizeCkConfigInput(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return value;
+  }
+  const normalized = structuredClone(value);
+  const updatePipeline = normalized.updatePipeline;
+  if (updatePipeline && typeof updatePipeline === "object" && !Array.isArray(updatePipeline)) {
+    const pipeline = updatePipeline;
+    if ("migrateProviders" in pipeline) {
+      pipeline.migrateProviders = normalizeMigrateProvidersValue(pipeline.migrateProviders);
+    }
+  }
+  return normalized;
+}
 var PlanValidationModeSchema, PlanFocusAreaSchema, PlanResolutionOrderSchema, ProjectTypeSchema, PackageManagerSchema, FrameworkSchema, GeminiModelSchema, StatuslineModeSchema, CodingLevelSchema, PlanResolutionSchema, PlanValidationSchema, CkPlanConfigSchema, CkDocsConfigSchema, CkPathsConfigSchema, CkLocaleConfigSchema, CkTrustConfigSchema, CkProjectConfigSchema, CkGeminiConfigSchema, CkSkillsConfigSchema, UpdatePipelineSchema, ResolvedModelConfigSchema, ModelTierMapSchema, CkModelTaxonomySchema, CkAssertionSchema, CkHooksConfigSchema, CkConfigSchema, DEFAULT_CK_CONFIG, CK_HOOK_NAMES;
 var init_ck_config = __esm(() => {
   init_zod();
@@ -42447,6 +42509,8 @@ var init_ck_config = __esm(() => {
 // src/types/index.ts
 var exports_types = {};
 __export(exports_types, {
+  normalizeMigrateProvidersInput: () => normalizeMigrateProvidersInput,
+  normalizeCkConfigInput: () => normalizeCkConfigInput,
   isValidKitType: () => isValidKitType,
   VidcapOptionsSchema: () => VidcapOptionsSchema,
   VersionCommandOptionsSchema: () => VersionCommandOptionsSchema,
@@ -42809,7 +42873,7 @@ class CkConfigManager {
       if (!existsSync12(configPath))
         return null;
       const content = await readFile8(configPath, "utf-8");
-      const data = JSON.parse(content);
+      const data = normalizeCkConfigInput(JSON.parse(content));
       return CkConfigSchema.parse(data);
     } catch (error) {
       logger.warning(`Failed to load config from ${configPath}: ${error instanceof Error ? error.message : "Unknown"}`);
@@ -42863,7 +42927,7 @@ class CkConfigManager {
     };
   }
   static async saveFull(config, scope, projectDir) {
-    const validConfig = CkConfigSchema.parse(config);
+    const validConfig = CkConfigSchema.parse(normalizeCkConfigInput(config));
     const configPath = scope === "global" ? CkConfigManager.getGlobalConfigPath() : projectDir ? CkConfigManager.getProjectConfigPath(projectDir) : null;
     if (!configPath) {
       throw new Error("Project directory required for project scope");
@@ -46709,21 +46773,15 @@ var init_file_watcher = __esm(() => {
 
 // src/domains/web-server/middleware/cors.ts
 function corsMiddleware(req, res, next) {
-  const origin = req.headers.origin;
-  if (origin && !origin.match(/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/)) {
+  const origin = getHeaderValue(req.headers.origin);
+  const normalizedOrigin = origin ? normalizeOrigin(origin) : null;
+  if (origin && (!normalizedOrigin || !isAllowedOrigin(normalizedOrigin, req))) {
     res.status(403).json({ error: "Forbidden: invalid origin" });
     return;
   }
-  const allowedOrigins = [
-    "http://localhost:3000",
-    "http://localhost:3456",
-    "http://localhost:5173",
-    "http://127.0.0.1:3000",
-    "http://127.0.0.1:3456",
-    "http://127.0.0.1:5173"
-  ];
-  if (origin && allowedOrigins.includes(origin)) {
-    res.setHeader("Access-Control-Allow-Origin", origin);
+  if (normalizedOrigin) {
+    appendVaryHeader(res, "Origin");
+    res.setHeader("Access-Control-Allow-Origin", normalizedOrigin);
   }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
   res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
@@ -46734,6 +46792,68 @@ function corsMiddleware(req, res, next) {
   }
   next();
 }
+function isAllowedOrigin(origin, req) {
+  if (LOCAL_DEV_ORIGINS.has(origin)) {
+    return true;
+  }
+  return getRequestOrigins(req).has(origin);
+}
+function getRequestOrigins(req) {
+  const origins = new Set;
+  const hosts = getHeaderValues(req.headers["x-forwarded-host"]).concat(getHeaderValues(req.headers.host));
+  const protocols = getForwardedProtocols(req);
+  for (const host of hosts) {
+    for (const protocol of protocols) {
+      origins.add(`${protocol}://${host}`);
+    }
+  }
+  return origins;
+}
+function getForwardedProtocols(req) {
+  const forwarded = getHeaderValues(req.headers["x-forwarded-proto"]).map((value) => value.toLowerCase());
+  const current = typeof req.protocol === "string" && req.protocol ? [req.protocol.toLowerCase()] : ["http"];
+  return Array.from(new Set([...forwarded, ...current].filter((value) => value === "http" || value === "https")));
+}
+function normalizeOrigin(origin) {
+  try {
+    return new URL(origin).origin;
+  } catch {
+    return null;
+  }
+}
+function getHeaderValue(value) {
+  if (Array.isArray(value)) {
+    return value[0];
+  }
+  return value;
+}
+function getHeaderValues(value) {
+  const raw = Array.isArray(value) ? value.join(",") : value;
+  if (!raw) {
+    return [];
+  }
+  return raw.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function appendVaryHeader(res, value) {
+  const current = res.getHeader("Vary");
+  if (!current) {
+    res.setHeader("Vary", value);
+    return;
+  }
+  const entries = String(current).split(",").map((entry) => entry.trim()).filter(Boolean);
+  if (!entries.includes(value)) {
+    entries.push(value);
+    res.setHeader("Vary", entries.join(", "));
+  }
+}
+var LOCAL_DEV_ORIGINS;
+var init_cors = __esm(() => {
+  LOCAL_DEV_ORIGINS = new Set(["localhost", "127.0.0.1", "[::1]"].flatMap((host) => [
+    `http://${host}:3000`,
+    `http://${host}:3456`,
+    `http://${host}:5173`
+  ]));
+});
 
 // src/domains/web-server/middleware/error-handler.ts
 function errorHandler(err, _req, res, _next) {
@@ -48509,7 +48629,7 @@ function registerCkConfigRoutes(app) {
         res.status(400).json({ error: "Invalid config payload" });
         return;
       }
-      const parseResult = CkConfigSchema.safeParse(config);
+      const parseResult = CkConfigSchema.safeParse(normalizeCkConfigInput(config));
       if (!parseResult.success) {
         res.status(400).json({
           error: "Config validation failed",
@@ -56724,7 +56844,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "claudekit-cli",
-    version: "3.37.0-dev.1",
+    version: "3.37.0-dev.3",
     description: "CLI tool for bootstrapping and updating ClaudeKit projects",
     type: "module",
     repository: {
@@ -62150,7 +62270,12 @@ var init_websocket_manager = __esm(() => {
 import { createServer } from "node:http";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 async function createAppServer(options2 = {}) {
-  const { port: preferredPort, openBrowser = true, devMode = false } = options2;
+  const {
+    port: preferredPort,
+    openBrowser = true,
+    devMode = false,
+    host = DEFAULT_DASHBOARD_HOST
+  } = options2;
   const port = await getPorts({ port: preferredPort || [3456, 3457, 3458, 3459, 3460] });
   const app = import_express2.default();
   app.use(import_express2.default.json({ limit: "10mb" }));
@@ -62183,15 +62308,15 @@ async function createAppServer(options2 = {}) {
       };
       server.once("listening", onListening);
       server.once("error", onError);
-      server.listen(port);
+      server.listen(port, host);
     });
-    logger.debug(`Server listening on port ${port}`);
+    logger.debug(`Server listening on ${host}:${port}`);
     if (openBrowser) {
       try {
-        await open_default(`http://localhost:${port}`);
+        await open_default(getBrowserUrl(host, port));
       } catch (err) {
         logger.warning(`Failed to open browser: ${err instanceof Error ? err.message : err}`);
-        logger.info(`Open http://localhost:${port} manually`);
+        logger.info(`Open ${getBrowserUrl(host, port)} manually`);
       }
     }
   } catch (error) {
@@ -62202,6 +62327,7 @@ async function createAppServer(options2 = {}) {
   }
   return {
     port,
+    host,
     server,
     close: async () => {
       fileWatcher?.stop();
@@ -62252,17 +62378,29 @@ async function setupViteDevServer(app, httpServer, options2) {
     serveStatic(app);
   }
 }
-var import_express2;
+function getBrowserUrl(host, port) {
+  if (WILDCARD_HOSTS.has(host) || LOOPBACK_OPEN_HOSTS.has(host)) {
+    return `http://localhost:${port}`;
+  }
+  return `http://${formatHostForUrl(host)}:${port}`;
+}
+function formatHostForUrl(host) {
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+var import_express2, DEFAULT_DASHBOARD_HOST = "127.0.0.1", LOOPBACK_OPEN_HOSTS, WILDCARD_HOSTS;
 var init_server = __esm(() => {
   init_logger();
   init_get_port();
   init_open();
   init_file_watcher();
+  init_cors();
   init_error_handler();
   init_routes();
   init_static_server();
   init_websocket_manager();
   import_express2 = __toESM(require_express2(), 1);
+  LOOPBACK_OPEN_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
+  WILDCARD_HOSTS = new Set(["0.0.0.0", "::"]);
 });
 
 // src/domains/web-server/index.ts
@@ -70604,6 +70742,10 @@ var init_config_command_help = __esm(() => {
         command: "ck config",
         description: "Launch the web dashboard (same as 'ck config ui')"
       },
+      {
+        command: "ck config --host 0.0.0.0 --no-open",
+        description: "Expose the dashboard to your network intentionally"
+      },
       {
         command: "ck config set defaults.kit engineer",
         description: "Set a config value from the CLI"
@@ -70651,6 +70793,10 @@ var init_config_command_help = __esm(() => {
             flags: "--port <port>",
             description: "Port for dashboard server"
           },
+          {
+            flags: "--host <host>",
+            description: "Bind dashboard host (default: 127.0.0.1)"
+          },
           {
             flags: "--no-open",
             description: "Do not auto-open browser when launching dashboard"
@@ -70674,7 +70820,7 @@ var init_config_command_help = __esm(() => {
     sections: [
       {
         title: "Notes",
-        content: "Run 'ck config --help' to see both CLI actions and dashboard flags. Running bare 'ck config' opens the dashboard directly."
+        content: "Run 'ck config --help' to see both CLI actions and dashboard flags. Running bare 'ck config' opens the dashboard directly. Use '--host' to expose the dashboard intentionally beyond localhost."
       }
     ]
   };
@@ -74708,12 +74854,16 @@ init_commands_discovery();
 // src/commands/config/config-ui-command.ts
 init_logger();
 var import_picocolors14 = __toESM(require_picocolors(), 1);
+import { networkInterfaces } from "node:os";
+var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
+var WILDCARD_HOSTS2 = new Set(["0.0.0.0", "::"]);
 async function configUICommand(options2 = {}) {
   const { port, dev = false } = options2;
+  const host = options2.host?.trim() || undefined;
   const noOpen = options2.open === false || options2.noOpen === true;
   try {
     if (port) {
-      const isAvailable = await checkPort(port);
+      const isAvailable = await checkPort(port, host);
       if (!isAvailable) {
         logger.error(`Port ${port} is already in use`);
         logger.info("Try: ck config (auto-selects available port)");
@@ -74726,13 +74876,20 @@ async function configUICommand(options2 = {}) {
     const server = await startServer({
       port,
       openBrowser: !noOpen,
-      devMode: dev
+      devMode: dev,
+      host
     });
-    const url = `http://localhost:${server.port}`;
+    const urls = getDashboardUrls(server.host, server.port);
     console.log();
     console.log(import_picocolors14.default.bold("  ClaudeKit Dashboard"));
     console.log(import_picocolors14.default.dim("  ─────────────────────"));
-    console.log(`  ${import_picocolors14.default.green("➜")} Local: ${import_picocolors14.default.cyan(url)}`);
+    if (urls.local) {
+      console.log(`  ${import_picocolors14.default.green("➜")} Local: ${import_picocolors14.default.cyan(urls.local)}`);
+    }
+    for (const url of urls.network) {
+      console.log(`  ${import_picocolors14.default.green(urls.local ? "•" : "➜")} Network: ${import_picocolors14.default.cyan(url)}`);
+    }
+    console.log(`  ${import_picocolors14.default.green("•")} Bind: ${import_picocolors14.default.cyan(server.host)}`);
     console.log();
     console.log(import_picocolors14.default.dim("  Press Ctrl+C to stop"));
     console.log();
@@ -74760,7 +74917,7 @@ async function configUICommand(options2 = {}) {
     process.exitCode = 1;
   }
 }
-async function checkPort(port) {
+async function checkPort(port, host) {
   const { createServer: createServer2 } = await import("node:net");
   return new Promise((resolve13) => {
     const server = createServer2();
@@ -74769,9 +74926,43 @@ async function checkPort(port) {
       server.close();
       resolve13(true);
     });
-    server.listen(port);
+    server.listen(port, host);
   });
 }
+function getDashboardUrls(host, port) {
+  if (WILDCARD_HOSTS2.has(host)) {
+    return {
+      local: `http://localhost:${port}`,
+      network: getDetectedNetworkUrls(port)
+    };
+  }
+  if (LOOPBACK_HOSTS.has(host)) {
+    return {
+      local: `http://localhost:${port}`,
+      network: []
+    };
+  }
+  return {
+    local: null,
+    network: [buildDashboardUrl(host, port)]
+  };
+}
+function getDetectedNetworkUrls(port) {
+  const urls = new Set;
+  for (const addresses of Object.values(networkInterfaces())) {
+    for (const address of addresses ?? []) {
+      if (address.internal) {
+        continue;
+      }
+      urls.add(buildDashboardUrl(address.address, port));
+    }
+  }
+  return Array.from(urls).sort();
+}
+function buildDashboardUrl(host, port) {
+  const formattedHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  return `http://${formattedHost}:${port}`;
+}
 
 // src/commands/config/phases/get-handler.ts
 init_config();
@@ -74935,9 +75126,10 @@ async function configCommand(action, keyOrOptions, valueOrOptions, options2) {
   }
   const rawOpts = options2 || (typeof keyOrOptions === "object" ? keyOrOptions : {});
   const uiOpts = {
-    port: rawOpts?.port,
-    noOpen: rawOpts?.noOpen,
-    dev: rawOpts?.dev
+    port: rawOpts.port,
+    noOpen: rawOpts.noOpen,
+    dev: rawOpts.dev,
+    host: rawOpts.host
   };
   return configUICommand(uiOpts);
 }
@@ -102663,7 +102855,7 @@ function registerCommands(cli) {
         console.error(`Unknown action: ${action}. Available: start, stop, status, logs, setup, queue, approve, reject`);
     }
   });
-  cli.command("config [action] [key] [value]", "Manage ClaudeKit configuration").option("-g, --global", "Use global config (~/.claudekit/config.json)").option("-l, --local", "Use local config (.claude/.ck.json)").option("--json", "Output in JSON format").option("--port <port>", "Port for UI server (default: auto)").option("--no-open", "Don't auto-open browser").option("--dev", "Run UI in development mode with HMR").action(async (action, key, value, options2) => {
+  cli.command("config [action] [key] [value]", "Manage ClaudeKit configuration").option("-g, --global", "Use global config (~/.claudekit/config.json)").option("-l, --local", "Use local config (.claude/.ck.json)").option("--json", "Output in JSON format").option("--port <port>", "Port for UI server (default: auto)").option("--host <host>", "Bind dashboard host (default: 127.0.0.1)").option("--no-open", "Don't auto-open browser").option("--dev", "Run UI in development mode with HMR").action(async (action, key, value, options2) => {
     await configCommand(action, key, value, options2);
   });
   registerProjectsCommand(cli);